fix: require auth for /api/status, add unauthenticated /api/health probe#48
Open
shellus wants to merge 1 commit into
Open
fix: require auth for /api/status, add unauthenticated /api/health probe#48shellus wants to merge 1 commit into
shellus wants to merge 1 commit into
Conversation
/api/status was exempt from the AUTH_TOKEN middleware so the Docker
healthcheck could reach it, but it leaks running_count, binary_version
and profiles_total without authentication. Scanners (e.g. fofa) use it
to fingerprint exposed instances.
Move /api/status behind auth (same as /api/profiles) and add a dedicated
/api/health probe that returns only {"status": "ok"} with no system
details. Point the Dockerfile healthcheck at /api/health and update the
exempt set, README and tests accordingly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
/api/statusis in the auth-exempt set so the Docker healthcheck can reach it. But withAUTH_TOKENset, it still returnsrunning_count,binary_versionandprofiles_totalwithout authentication. This is an information-disclosure endpoint that scanners (e.g. fofa) use to fingerprint exposed Manager instances and learn how many profiles exist.Change
GET /api/healthprobe that returns only{"status": "ok"}with no system details, and keep it auth-exempt./api/statusfrom the exempt set, so it now requires the token like/api/profiles.HEALTHCHECKat/api/health.Tests
test_healthcheck_always_accessiblenow probes/api/health.test_status_requires_auth:/api/statusreturns 401 without a token and 200 with the correct Bearer token.test_auth.py+test_api.pysuite passes (60 passed).No frontend impact: the dashboard determines auth state via
/api/auth/status, andgetStatus()(which calls/api/status) runs only inside the authenticated app.